The financial, operational and reputational consequences of a cyber attack can be devastating.

On average, organizations have had to shell out a whopping $3.86 million per incident, according to the Ponemon Institute.

But often the damage can run much deeper than these initial upfront financial costs.

Here is a guide to the steps to take within the first two weeks if your company suffers a cyber attack.

Put a Plan in Place

Taking a step back, as a starting point, you should put a robust incident response plan in place before an incident is even able to take place.

The plan should be constructed by key stakeholders including senior management across all relevant departments and cyber security and legal experts, tailored to your specific systems and the type of data you are handling.

As a basic, the plan should include details on how to contain, eliminate and recover from a breach. That plan should be regularly stress-tested to make sure that it works effectively by using a range of different scenarios.

“Oftentimes, company that are victims of a cyber attack don’t have an immediate sense of the scale of what has just happened to them and aren’t as prepared as they thought they would be,” said Michael Phillips, chief claims officer at Resilience.

“Therefore, it’s critical for them to have a strong incident response plan in place that clearly identifies the key stakeholders involved and immediate steps that need to be taken in the event of a cyber attack.

“You need to have the whole cross-section of leadership involved at the outset, from legal, finance and risk to HR and communications, not just IT and security. Too often, companies silo their responses by expertize, when in reality it requires a coordinated approach with all departments working together.”

You should also engage your insurer and broker, both of which can explain what happens in the event of an incident and advise you on the best law firm and forensic team to appoint. They will also detail all the services you are covered for under your policy.

Day One: Get the Facts

Now that you have a plan, you are prepared for that fateful day a cyber attack occurs. The first step after incident is to identify, understand the scope of and contain the problem.

That means engaging your legal counsel to advise you, as well as an independent external cyber security forensics expert, as soon as possible to determine the cause of the attack and what, if any, data has been compromised, while your IT and security team isolate the problem.

“It’s essentially about damage control,” said Geoffrey Lottenberg, partner at Berger Singerman.

“You need to figure out exactly what happened and to contain the problem. Doing that can often take a couple of days, depending on how significant the initial attack was.”

You also need to notify your insurer and broker as soon as possible. Because your insurance policy may have a limitation, coverage may be invalidated or denied if an incident isn’t reported within the required timeframe set out in the terms and conditions.

Jeremy Gittler, practice leader and head of cyber claims for the Americas at AXA XL, said: “Your insurer is your one-stop shop in the event of a cyber attack to help you every step of the way. They will do everything from recommending a forensics team and law firm to advising you on the best action to take depending on your specific set of circumstances to get back on your feet as soon as possible.”

Nick Hamblen, head of claims at Cowbell Cyber, added: “A co-operative and transparent response from the onset assists both the insurer and the insured with managing costs related to the various expenses that accompany a ransomware event.

“Worst case scenario is when organizations try to reconcile the situation on their own. For example, ransomware responses are complex and evolve processes that are made significantly easier with the right help in place. Insurers can enlist the most resources and breach counsel for any given situation.”

Day Two to Three: Eliminate the Issue

Now that the problem has been contained, you need to eliminate it.

Depending on the extent of the attack, that could require you to take some far-reaching measures, whether that involves shutting down entire systems or coming offline for an extended period.

“Be careful what action you take internally though,” warned Oren Wortman, managing director, cyber risk advisory at Beecher Carlson. “Don’t do anything drastic like wiping a machine because you could end up damaging the critical forensic evidence.”

Jeremy Gittler, practice leader and head of cyber claims for the Americas, AXA XL

If you main server has been breached, in order to continue operating online, you should move to a back-up server.

You should also use secure out-of-band communication and avoid using company email because your email system may have been compromised too.

Alongside elimination of the problem, you also need to report the incident to the regulator. Most U.S. states have statutes outlining the reporting requirements for a breach and the timeframe it has to be done within, typically within 48- to 72-hours of an attack being identified.

As well as state laws such as the California Consumer Privacy Act, you need to be aware of regulations in other countries you operate in or have customers or suppliers in, for example, the European Union’s General Data Protection Regulation.

To make sure that you are adhering to the different reporting requirements, you should engage a cyber counsel to establish exactly what you need to do.

“For example, if you are an ecommerce company based in Florida and you sell to customers across the country, you will have to adhere to all the different reporting requirements in each of the other states you distribute your product or service in,” said Lottenberg.

“That means notifying all of the appropriate authorities in a timely fashion.”

Where financial fraud has been committed, you should also report the incident to the relevant law enforcement body. That may be at the federal, state or even international level, depending on the severity level.

Day Three to Four: Outreach 

The next step is to determine whether you need to communicate the problem to your customers and employees.

While there’s nothing worse than a customer finding out through the press or social media about an incident before you tell them, it’s important to establish the full facts first and not admit liability if the problem won’t actually affect them.

“The rule of thumb is that you should never disclose any information until you have first consulted with your legal counsel,” said Phillips.

“Often there is an urge to be as upfront as possible, but sometimes that can do more harm than good, because you could be admitting liability for something that didn’t happen or you could be unnecessarily exacerbating an already tense situation.”

If you establish that a customer or employee’s data has been compromised you have an obligation to explain what has happened and try to address any concerns they may have and outline how you are going to deal with the issue.

You should engage a public relations firm that specializes in crisis management to work with your attorneys to draw up a statement that is sent out to all relevant parties concerned.

Again, you need to make sure this is done according to any timing requirements, depending on the jurisdiction you are operating or selling in. You should also decide whether to compensate the customer for any damage or inconvenience.

One to Two Weeks After: Prevention

Once the incident has been fully cleared up, you need to start putting steps in place to ensure it doesn’t happen again.

You should start by reviewing your incident response plan to see how well it worked and identify any improvements that can be made, taking on board key lessons learned.

“Essentially, you need to examine the root causes and determine what you should do to make sure it doesn’t happen again,” Wortman said.

“You should also be looking to identify patterns and indicators of entry to ensure that no further systems or assets have been compromised or could be in the future.”

This will inevitably mean you have to invest in plugging any holes and strengthening your cyber security defenses. You also need to make sure that any third parties that handle your customer data adhere to the same stringent cyber security practices because you can be liable if the suffer an attack, too.

“Many companies are still on their cyber security journey and building their resilience,” Phillips said.

“Others may have invested heavily in the latest and greatest technology and personnel, but they are still susceptible to human error and hackers who are always looking to stay one step ahead.”

Make sure that you document proof of losses for business interruption claims too. Cyber attacks will also impact on future renewals, so you need to be in constant dialogue with your insurer and broker to let them know what steps you are taking to prevent further incidents.

If a lawsuit is filed, you also need to address that whether in front of a judge or as an out-of-court settlement.

Ongoing litigation can take years in some cases and you need to make sure that you have sufficient resources to handle it.

Cyber security is a constant, ongoing process that you need to manage and ensure your organization is doing it properly at all times.

Cyber criminals are always looking for new vulnerabilities and once they have identified one they are quick to exploit it, so you need to be one step ahead. &